claudetools/session-logs/2026-06/2026-06-21-howard-gururmm-features-audit-submodule-fix.md

## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech

## Session Summary

Worked through a batch of GuruRMM roadmap/bug items, ran a full codebase audit, and ended by root-causing and fixing a ClaudeTools sync bug that had been disrupting the whole session. Started by listing outstanding skill/roadmap work (excluding bitdefender/unifi/guru-scan), then implemented in sequence: SPEC-021 (logged-in-user domain & account-type detection) + the BUG-020 watchdog tray-teardown follow-up; the "Add Devices"/"Enroll an Agent" modal UX fix (top-X close, click-outside + Escape dismissal, refresh-on-close); BUG-018 (reliable agent deletion); and the "Open in MSP360" deep-link button (RMM_THOUGHTS Feature 3). Each landed full-stack on its own branch and was compile-validated (server `cargo check`, dashboard `tsc -b && vite build` run server-side in a throwaway git worktree, since this machine has no `node_modules`).

The enrollment modal fix was the only item taken all the way to production this session: built the feature branch's dashboard onto the beta web root via a git worktree, the user tested it on rmm-beta, then promoted beta to prod with `promote-dashboard.sh --confirm`. Established (and saved as a feedback memory) a standing rule that GuruRMM **dashboard** changes go to beta first, before main, unless told otherwise — and documented that the pipeline auto-builds beta from `main`, so getting a branch onto beta means a manual worktree build, not a merge.

Ran `/rmm-audit` (5 parallel Opus passes + a build-pipeline pass over SSH). It surfaced one real HIGH bug — assigning/unassigning any policy silently wiped a connected agent's Event Log Watch monitoring (the third instance of a clobber class already fixed at two other config-push sites) — which was fixed by reusing the single rule-shaper. The audit also flagged a MEDIUM info-disclosure (raw error strings in 500 bodies) that turned out to be **already fixed in main** (commit `58c1a96`); it was a false positive because the audit agents read a stale working tree.

Lined up the four pending GuruRMM branches as Gitea PRs (#40-#43) with the migration merge-order (060 → 061 → 062) spelled out, DM'd Mike the lineup, and synced. Finally, diagnosed why the guru-rmm submodule kept reverting to a stale commit (`2e469f1`) and discarding work all session: `sync.sh` ran `git submodule update --init` unconditionally on every sync, re-checking-out the intentionally-lagging pinned gitlink in detached HEAD. Guarded it to only populate genuinely-missing submodules, verified guru-rmm now stays on `main` through a sync, and pushed the fix fleet-wide.

## Key Decisions

- **Dashboard changes go to beta before main** (saved as memory `rmm-dashboard-beta-before-main`). Beta auto-builds from `main`, so a feature branch is previewed by building its `dashboard/` in a `git worktree` and rsyncing `dist/` to `/var/www/gururmm/dashboard-beta`; promotion to prod is the separate human-run `promote-dashboard.sh --confirm`.
- **BUG-018 root cause corrected against the live DB**, not the roadmap's guess: the two huge cascade children (`metrics` ~6.4 GB, `agent_logs` ~3.5 GB) were already indexed on `agent_id`; only five small FKs were unindexed (migration 061). The real operator fix is the new `POST /api/agents/bulk-delete` (one transaction), not the indexes.
- **MSP360 deep-link placement unified**: the backup-alert "Investigate" action already deep-links to `?tab=backup`, so a single button on the backup-tab plan card covers both placements; no separate alert-row button (the alert doesn't carry the console id).
- **Event Log Watch fix reused the existing shaper** (`watch_rules_for_agent` retargeted from `&AppState` to `&PgPool`) rather than duplicating the rule-mapping JSON — one source of truth across all three push sites.
- **Submodule fix guarded the clobber, did not bump the gitlink**: CLAUDE.md intends the parent's pinned gitlink to lag `main`; the bug was `sync.sh` re-checking-out that pin over live work, so the fix is a populate-only guard, preserving the lag-by-design behavior.
- **Used a SHA-push workaround** (commit → cherry-pick onto `origin/main` → `git push origin <sha>:refs/heads/<branch>` → verify with `ls-remote`) to land branches reliably while the submodule kept detaching, before the root cause was found.

## Problems Encountered

- **Submodule kept reverting to `2e469f1` (detached HEAD), discarding uncommitted edits** — caused multiple dangling-commit recoveries and one reverted sed edit. Worked around with SHA-pushes, then root-caused: `sync.sh:339` `git submodule update --init` ran unconditionally. Fixed with a `git -C "$ppath" rev-parse --git-dir` populate-only guard. Verified guru-rmm now survives a sync on `main @ ed8cad3`.
- **Audit ran against a stale checkout** (working tree pinned at `2e469f1`, 5 commits behind `origin/main`). One MEDIUM finding (500-body info-disclosure, 17 sites) was already fixed in main by `58c1a96`; caught before shipping a redundant change, deleted the bogus branch, corrected the report. Re-verified all other findings against real main — only that one was stale. Same submodule root cause as above.
- **Build-server SSH host key changed** — `172.16.3.30` was rebuilt as a new physical box on 2026-06-11 (per wiki), so the ED25519 key legitimately changed. Refreshed `known_hosts` after confirming the rebuild, rather than blindly bypassing.
- **No SSH key on Howard-Home for the build server** — used the dedicated `gururmm-physical` key from the SOPS vault (extract to a temp keyfile, `ssh -i`, delete after).

## Configuration Changes

**ClaudeTools repo (committed + pushed):**
- `M .claude/scripts/sync.sh` — populate-only guard on the submodule update (Phase 1a) so already-populated submodules are never re-checked-out to the lagging gitlink.
- `A .claude/memory/rmm-dashboard-beta-before-main.md` + index pointer in `.claude/memory/MEMORY.md`.
- `M errorlog.md` — three entries: two `--friction` (detached-HEAD submodule; stale audit base) and the root-cause fix context.

**guru-rmm submodule (on feature branches, not yet merged):**
- `feat/spec-021-and-bug-020-tray-teardown`: `agent/src/metrics/mod.rs`, `agent/Cargo.toml`, `agent/src/watchdog/{mod,monitor,wts}.rs`, `server/migrations/060_logged_in_user_domain.sql`, `server/src/db/metrics.rs`, `server/src/ws/mod.rs`, `dashboard/src/{api/client.ts,pages/AgentDetail.tsx}`, `docs/specs/SPEC-021-*.md`, `docs/FEATURE_ROADMAP.md`.
- `fix/bug-018-agent-delete-indexes`: `server/migrations/061_index_agent_foreign_keys.sql`, `server/src/db/agents.rs`, `server/src/api/{agents,mod}.rs`, `dashboard/src/{api/client.ts,pages/Agents.tsx}`, `docs/FEATURE_ROADMAP.md`.
- `feat/msp360-deeplink`: `server/src/mspbackups/{client,sync}.rs`, `server/src/db/mspbackups.rs`, `server/src/api/mspbackups.rs`, `server/migrations/062_backup_provider_console_id.sql`, `dashboard/src/{api/client.ts,lib/provider-links.ts,components/BackupDetailTab.tsx}`, `docs/RMM_THOUGHTS.md`.
- `fix/eventlog-watch-policy-clobber`: `server/src/api/event_log_watches.rs`, `server/src/ws/mod.rs`, `server/src/api/policies.rs`.
- `fix/enrollment-modal-ux` (MERGED to main as `4027c86`): `dashboard/src/components/{EnrollmentModal,EnrollAgentModal}.tsx`, `dashboard/src/pages/{SiteDetail,ClientDetail}.tsx`.
- Untracked (NOT committed): `projects/msp-tools/guru-rmm/reports/2026-06-21-rmm-audit.md`.

## Credentials & Secrets

No new credentials created. Used (all already vaulted):
- SSH to build server: `gururmm-physical` ed25519 key — vault `infrastructure/gururmm-server-physical.sops.yaml` field `credentials.ssh-private-key` (user `guru@172.16.3.30`, key-only auth; password auth disabled on the new box).
- Sudo on build server (for promote): `Paper123!@#-rmm` — vault `infrastructure/gururmm-server.sops.yaml` `credentials.password`.
- Postgres (schema query): vault `infrastructure/gururmm-server.sops.yaml` `credentials.databases.postgresql-password` (db `gururmm`, user `gururmm`, localhost:5432).
- Gitea API (PR creation): vault `services/gitea-howard.sops.yaml` `credentials.password` (user `howard`, internal `http://172.16.3.20:3000`).

## Infrastructure & Servers

- **GuruRMM server** `172.16.3.30` (hostname `gururmm`) — physical Lenovo ThinkCentre M83, Ubuntu 26.04, replaced the Jupiter VM at this IP on 2026-06-11. Repo `/home/guru/gururmm`. Build pipeline `/opt/gururmm/*.sh`, webhook `:9000`. Postgres 18, MariaDB, GuruRMM API `:3001`, Coord API `:8001`.
- Dashboard web roots: beta `/var/www/gururmm/dashboard-beta` (https://rmm-beta.azcomputerguru.com), prod `/var/www/gururmm/dashboard` (https://rmm.azcomputerguru.com). API https://rmm-api.azcomputerguru.com.
- Channel model: webhook auto-builds beta from `origin/main`; prod is updated only by `promote-dashboard.sh --confirm` (backs up prod first; `--rollback` to undo).
- Gitea: git.azcomputerguru.com (internal `172.16.3.20:3000`), repo `azcomputerguru/gururmm`.

## Commands & Outputs

- Beta preview build (per branch, no main merge):
  `git worktree add --detach <wt> origin/<branch>` → `cd <wt>/dashboard && npm install && npm run build` → `rsync -a --delete dist/ /var/www/gururmm/dashboard-beta/`. Do NOT touch `/opt/gururmm/last-built-commit-dashboard`.
- Promote beta→prod: `sudo /opt/gururmm/promote-dashboard.sh --confirm` (prod backup written to `/var/www/gururmm/.dashboard-backups/dashboard-20260621-191008`). Undo: `... --rollback`.
- Unindexed-FK / schema queries run via `PGPASSWORD=... psql -U gururmm -d gururmm -h localhost`.
- PR creation: `POST http://172.16.3.20:3000/api/v1/repos/azcomputerguru/gururmm/pulls` (basic auth `howard:<pw>`, JSON built with `jq -nc --arg`).
- Submodule-clobber fix verified: guru-rmm `main @ ed8cad3` before AND after a full `sync.sh` run (previously reverted to detached `2e469f1`).

## Pending / Incomplete Tasks

- **Four GuruRMM PRs await Mike's review/merge** — merge migrations in order:
  - #40 SPEC-021 + BUG-020 (migration 060) — FIRST. SPEC-021 also needs a Pluto signed-MSI agent build + fleet rollout.
  - #41 BUG-018 (migration 061) — after 060.
  - #42 MSP360 deep-link (migration 062) — last.
  - #43 Event Log Watch HIGH fix — no migration, merge anytime.
- After each PR with a dashboard portion merges to main, it auto-builds to beta; promote to prod when validated.
- **Remaining audit findings** (all re-verified valid against real main): LOW DoS `cap_field` batch (DiscoveryResult / WatchdogEvent / NetworkState / Auth hostname in `ws/mod.rs`), SSE status-stream revocation bypass + JWT-in-URL (`agents.rs:758-762`), two `console.log` stubs (`AgentDetail.tsx:670`, `Logs.tsx:198`), `ContextTree.tsx` missing `isError`, and the roadmap reconciliation (5 shipped-but-unchecked items to flip `[ ]`→`[x]` + 3 partials to annotate).
- The audit report `reports/2026-06-21-rmm-audit.md` is untracked in the guru-rmm submodule working tree — not yet committed to the gururmm repo.

## Reference Information

- PRs: https://git.azcomputerguru.com/azcomputerguru/gururmm/pulls/40 (..43)
- Branch tips: SPEC-021/BUG-020 `7083e39`; BUG-018 `604c42f`; MSP360 `776b587`; eventlog fix `432b434`; enrollment (merged) `4027c86`.
- guru-rmm `origin/main` = `ed8cad3`; the already-shipped info-disclosure fix = `58c1a96`; the stale gitlink the submodule was pinned at = `2e469f1`.
- Discord DMs to Mike: prod-promote confirmation (msg 1518332316114489505), PR lineup (msg 1518361486509215955).
- Memory added: `.claude/memory/rmm-dashboard-beta-before-main.md`.

---

## Update: 17:39 PT — concurrent-session fallout + BUG-018 rework to Mike's spec

### Summary
Discovered a concurrent Claude session (GURU-5070/claude-main, Mike's machine) was working the same guru-rmm tree — branch refs/HEAD kept moving under me. Mike then sent coord decisions: BUG-018 is mine to do as a fast **202 + background purge** (it's row volume, not indexes); BUG-019 he approved + merges himself; pfSense Option A + Tier-1 2a/2b are his/settled. Acted on the guru-rmm fallout only (the rest is GURU-5070's). Created a 6-item TaskList and worked it to done, isolating all work in `git worktree`s + push-by-SHA to dodge the shared-tree races.

Reworked BUG-018 (PR #41) to the 202+bg design, renumbered SPEC-021's migration 060→063 to clear a collision with BUG-019's 060, opened PR #44 for the earlier audit-cleanup branch, and flagged a Gitea-SSH/build-pipeline refusal. Mike replied: BUG-019 built clean (v0.6.67 beta, marker `8b5e0dc`), Gitea SSH was only transiently down (build completed before the refusal), and he pushed a `gururmm-build` skill + `docs/BUILD.md` + build memories (picked up by this sync). Remaining PRs + the stateful-alert-lifecycle shape-spec are handed to another session.

### Key decisions
- BUG-018 → Mike's **202 + background purge**: mark `status='deleting'` synchronously (fast UPDATE, also the existence check), spawn a background tokio task for the cascade purge, return 202; fleet listings/stats exclude `'deleting'` so the row leaves the UI immediately. Kept the bulk endpoint + FK indexes (mig 061 — speeds the bg purge).
- Migration order finalized: **060 BUG-019, 061 BUG-018, 062 MSP360, 063 SPEC-021** (renumbered SPEC-021 since Mike merges BUG-019's 060).
- Always isolate submodule work in a `git worktree` when concurrent sessions may share the tree; commit + push by explicit SHA, never trust the shared branch ref. (Logged as friction.)
- Stateful-alert-lifecycle shape-spec paused mid-Phase-2 (awaiting priority + out-of-scope) — now handed to another session per Howard.

### Problems encountered
- Concurrent session moved HEAD/branch refs + mixed both sessions' uncommitted changes into the shared tree; resolved by committing in a worktree off origin/main and push-by-SHA, leaving the other session's files untouched.
- Build-host `git fetch` over Gitea SSH (`git@172.16.3.20:2222`) refused 3x during validation; validated instead via internal HTTP (`http://...@172.16.3.20:3000`). Mike confirmed it was transient.

### Configuration changes (this update)
- guru-rmm `fix/bug-018-agent-delete-indexes` (`de9b089`): server/src/api/agents.rs (202 + mark-deleting + bg purge, bulk too), server/src/db/agents.rs (`mark_agents_deleting`, `'deleting'` filter on list/stats queries), dashboard/src/api/client.ts + pages/Agents.tsx (202 flow, `deleted`->`accepted`).
- guru-rmm `feat/spec-021-and-bug-020-tray-teardown` (`9171f84`): renamed migration `060_logged_in_user_domain.sql` -> `063_`; updated the SPEC-021 note + roadmap reference.
- Coord: claimed + released lock `gururmm/bug-018-agent-delete`; messaged GURU-5070 (3 msgs).

### Pending (handed to another session per Howard)
- PRs awaiting Mike's merge: #40 (SPEC-021/BUG-020, mig 063), #41 (BUG-018 202+bg, mig 061), #42 (MSP360, mig 062), #43 (eventlog HIGH), #44 (audit cleanup). Merge migrations in order 060→063.
- Stateful-alert-lifecycle shape-spec (paused at Phase 2).

### Reference (this update)
- Branch tips: BUG-018 `de9b089`, SPEC-021 `9171f84`. BUG-019 built `v0.6.67`, marker `8b5e0dc`.
- New from Mike (via sync): `gururmm-build` skill, guru-rmm `docs/BUILD.md`, memory `feedback_gururmm_build_verification`; fabb3421 app DELETED (use Exchange Operator b43e7342 for client mail, 1873b1b0 for /mailbox).
- Coord msgs to GURU-5070: 7a4747b8 (claim), 0c2ae45e (done + SSH flag). Discord DM 1518411100927033464 (build-outage flag).

---

## Update: 20:35 PT — Roadmap verification, BUG-021 correction, BUG-022 fix (watchdog dead code)

### Session Summary
Continued the roadmap verification pass after compaction. Did a deep functional verification of
the live GuruRMM system (270 agents / 178 online, metrics flowing ~2531 rows/15 min, alerts with 0
legacy null dedup_keys, per-agent API endpoints all 200 on a real agent). The one unverified spot
was `watchdog_events`/`watchdog_alerts` = 0 all-time. Traced both paths end-to-end against
`origin/main`: the watchdog's REST escalation path (`watchdog-alert`, fires after 3 failed restarts)
is sound — 0 alerts = healthy fleet. But `watchdog_events` = 0 because the agent **never produces**
a `WatchdogEvent`: the WS variant was defined + fully server-handled (`insert_watchdog_event` + a
`watchdog_events` table) yet had no producer, and architecturally couldn't (the watchdog is a
separate companion process with no WS connection). Dead/orphaned path → filed BUG-022 (LOW).

Mid-session, Howard noted Mike likely fixed the earlier build issues. Re-checked the LIVE build
marker and found I had been reporting a stale snapshot: the Windows build went **green** at
2026-06-22 02:19 (`v0.6.67`, `last-built-commit-windows == origin/main 1dce66d`). BUG-021 was
already **fixed** on main via `1dce66d` (pinned `getrandom 0.3.1` + `zeroize 1.8.1` below
edition2024 — exactly the dep-pin I had diagnosed + flagged; the fix even reused the BUG-021 label).
Also on main since the snapshot: BUG-018 (202+bg, `cea87d4`) and the Event Log Watch management UI
(`0fa65f5`). Corrected the BUG-021 roadmap entry to **Fixed** (`97045ec`).

Then fixed BUG-022. For a LOW dead-code defect, chose option (a) — **remove the orphaned path** —
over building a new feature (granular watchdog reporting is a product call for Mike). Removed the
`WatchdogEvent` variant + payload + enum from `agent/src/transport/mod.rs`, the variant + payload
struct + match arm + `insert_watchdog_event` call from `server/src/ws/mod.rs`, and the
`watchdog_events::*` re-export from `server/src/db/mod.rs`; gutted `db/watchdog_events.rs` to a
doc-only stub (keeps the table↔module invariant; left the empty table to avoid a migration-number
collision with the open PR train). Compile-verified on the build server: `cargo check` clean on
server (48.9s) + agent (15.7s), no new warnings. Pushed `fix/bug-022-watchdog-event-deadcode`
(`4eb5054`), opened **PR #45** (code) and **PR #46** (docs: BUG-021/BUG-022 fixed + an RMM thought
for the REST-based granular-watchdog follow-up). Did not merge — merging the code PR triggers a
fleet build+deploy, left to Howard/Mike.

### Key Decisions
- BUG-022 fix = **remove dead code**, not implement granular events. Proportionate for LOW; the
  feature alternative needs Mike's go (GuruRMM project) and a design (REST producer, since the
  watchdog has no WS connection). Captured the feature idea in RMM_THOUGHTS instead of discarding it.
- Left the empty `watchdog_events` table in place (no DROP migration) to avoid colliding with the
  in-flight PR migration numbers (061/062/063 on open PRs #40-42); flagged for a future consolidated
  cleanup migration.
- Kept the code fix branch **code-only** and put the doc status flip on the existing docs branch
  (disjoint files → no merge conflict between PR #45 and #46).
- Did not merge either PR — merging code to main = fleet deploy (hard-to-reverse, outward-facing).

### Problems Encountered
- **Stale build-status reporting (friction, logged):** reported BUG-021 as still-failing from a
  build-log snapshot; it had already gone green by report time. Same "acted on a point-in-time read"
  class as the earlier stale-audit-base slip. Fix recorded: re-check the LIVE `last-built-commit`
  marker vs `origin/main` (and the latest build SUCCESS line, not just the last FAILED line) before
  asserting build status. `errorlog.md` ref=`stale-audit-base-friction`.
- **Submodule reset to stale `2e469f1` again:** the initial watchdog grep ran against old code.
  Re-ran authoritatively with `git grep origin/main` and did all edits in worktrees off `origin/main`
  + push-by-SHA (the established concurrency-safe pattern).
- **`cargo: command not found` on non-interactive SSH:** the build server's cargo is under
  `~/.cargo/bin`; sourcing `~/.cargo/env` fixed it (cargo 1.96 on `.30`).

### Configuration Changes (this update)
- guru-rmm `fix/bug-022-watchdog-event-deadcode` (`4eb5054`): removed dead WatchdogEvent path across
  `agent/src/transport/mod.rs`, `server/src/ws/mod.rs`, `server/src/db/mod.rs`,
  `server/src/db/watchdog_events.rs` (doc-only stub).
- guru-rmm `docs/bug-021-windows-build` (`487431f`): BUG-021→Fixed + BUG-022 entry→Fixed in
  `docs/FEATURE_ROADMAP.md`; granular-watchdog-visibility thought appended to `docs/RMM_THOUGHTS.md`.
- `errorlog.md`: one `--friction` entry (stale build-status reporting).

### Pending / Incomplete (this update)
- **PR #45** (code) + **PR #46** (docs) await merge by Howard/Mike. Merge #45 before #46. Merging #45
  = fleet build+deploy.
- Empty `watchdog_events` table still present — drop in a future consolidated cleanup migration.
- Granular watchdog visibility (REST `watchdog-event` producer) — RMM_THOUGHTS, Raw, needs Mike's go.

### Reference (this update)
- BUG-021 fix on main: `1dce66d` (getrandom 0.3.1 + zeroize 1.8.1 pin). BUG-018 on main: `cea87d4`.
  Event Log Watch UI: `0fa65f5`. Windows build green: `v0.6.67`, marker `1dce66d`, 2026-06-22 02:19.
- Branch tips: fix `4eb5054`, docs `487431f`. PRs: #45 (code), #46 (docs).
- Verified live: 270 agents/178 online; REST `watchdog-alert` path sound; `watchdog_events`=0 = dead
  WS path (no producer).

---

## Update: 10:35 PT (2026-06-22) — Tracker reconciliation + GuruRMM wiki full recompile

### Session Summary
Closed out the session by making the living docs and wiki truthful for everything that landed.
First reconciled the trackers against `main`: flipped BUG-018 from "Investigated/Open" to **Fixed**
(`cea87d4` — DELETE returns 202 + background purge) and marked the **Event Log Watch management UI**
`[x]` complete in `UI_GAPS.md` (`0fa65f5`), bumping its Last-Updated. These went on the existing docs
branch (PR #46) so they stay file-disjoint from the BUG-022 code PR (#45).

Then ran the recommended wiki update (decoupled from `/save`, so the prior save didn't do it):
`/wiki-compile project:guru-rmm --full`. The `guru-rmm` article turned out to be a **tombstone
redirect** — the canonical article is `gururmm` (no hyphen). Switched target and did a full recompile
of `wiki/projects/gururmm.md` (651 -> 775 lines) by delegating gather+synthesis to a Sonnet agent: it
read live artifacts from `origin/main` (migrations, routes, roadmap, BUILD.md, recent commits) + the
delta session logs (2026-06-12 -> 22) + the existing article, and produced an updated article folding
in BUG-018/020/021/022, Event Log Watch UI, SPEC-021, MSP360 deep-link, enrollment-modal UX, the
two-wave (stable + legacy-1.77) Windows build, the BUG-021 dep-pin gotcha, and the watchdog section
corrected to REST-`watchdog-alert`-only per BUG-022. Reviewed the staged diff, caught + removed a
stale carryover (the article still listed the watchdog-alerts UI resolve/delete routes as "missing" —
they exist + the UI is complete), applied it, refreshed the `wiki/index.md` GuruRMM row (v0.6.67,
~270 enrolled) + header date, committed to main (`b977f5e`), and released the per-article coord lock.

### Key Decisions
- Tracker edits for BUG-018 + Event Log Watch UI went on the docs branch (PR #46), not a new branch —
  same file (`FEATURE_ROADMAP.md`/`UI_GAPS.md`), keeps it bundled with the other verification-pass doc
  updates and disjoint from the code PR.
- Wiki recompile delegated to a Sonnet agent (per the skill + the high-volume multi-source read) — it
  wrote to `.claude/wiki_staging/` and I reviewed/applied, keeping the 97 KB synthesis out of main ctx.
- Compiled the canonical slug `gururmm`, NOT `guru-rmm` (the tombstone redirect caught the hyphen trap).

### Problems Encountered
- **`/save` recommends the wrong wiki slug for GuruRMM:** Phase 3 derives `project:guru-rmm` from the
  submodule directory name, but the canonical wiki article is `gururmm` (the `guru-rmm.md` is a
  tombstone redirect). Caught immediately by reading the stub. Logged as a friction so the `/save`
  slug derivation can map `guru-rmm -> gururmm`.
- **Stale carryover in the recompiled article:** the Sonnet draft kept an old "watchdog-alerts UI
  routes missing on server" gap that is actually shipped/complete. Caught it in the Phase-5.2 staged
  review and removed it before applying — full recompiles inherit stale claims, so the diff review is
  load-bearing.

### Configuration Changes (this update)
- guru-rmm `docs/bug-021-windows-build` (`855b46b`): `FEATURE_ROADMAP.md` BUG-018 -> Fixed;
  `UI_GAPS.md` Event Log Watch UI `[ ]` -> `[x]` + Last-Updated bump.
- ClaudeTools main (`b977f5e`): `wiki/projects/gururmm.md` full recompile (651 -> 775 lines);
  `wiki/index.md` GuruRMM row + header refreshed.
- `errorlog.md`: one `--friction` entry (`/save` wiki-slug derivation `guru-rmm` vs canonical `gururmm`).

### Pending / Incomplete (session close)
- **PR #45** (BUG-022 code) + **PR #46** (BUG-018/021/022 + Event Log Watch roadmap/UI_GAPS + RMM
  thought) await Howard/Mike merge. Merge #45 before #46; merging #45 = fleet build+deploy.
- Empty `watchdog_events` table retained — drop in a future consolidated cleanup migration.
- Granular watchdog visibility (REST `watchdog-event` producer) — RMM_THOUGHTS, Raw, needs Mike's go.

### Reference (this update)
- Wiki: `wiki/projects/gururmm.md` (canonical; `guru-rmm.md` = tombstone redirect). Commit `b977f5e`.
- Docs branch tip: `855b46b`. Coord lock `9d9dc3ef` (claimed + released).